CVE-2025-14094
📋 TL;DR
This CVE describes an OS command injection vulnerability in Edimax BR-6478AC V3 routers. Attackers can remotely execute arbitrary commands on affected devices by manipulating the sysCmd parameter. All users of this specific router model with vulnerable firmware are affected.
💻 Affected Systems
- Edimax BR-6478AC V3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Unauthorized command execution leading to network reconnaissance, credential harvesting, or device configuration changes.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit requires authentication to the web interface. Public proof-of-concept available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Check Edimax website for firmware updates. Vendor did not respond to disclosure.
🔧 Temporary Workarounds
Disable Remote Management
allTurn off WAN access to router web interface
Access router admin panel > Advanced Settings > Remote Management > Disable
Restrict Admin Access
allLimit admin interface access to specific IP addresses
Access router admin panel > Advanced Settings > Access Control > Add allowed IPs
🧯 If You Can't Patch
- Replace vulnerable router with different model/supplier
- Place router behind firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel: System > Firmware InformationCheck Version:
Check web interface at http://router-ip/ or use nmap: nmap -sV -p80,443 router-ipVerify Fix Applied:
No fix available to verify. Monitor for firmware updates from vendor.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- Traffic to known exploit repositories
SIEM Query:
source="router-logs" AND (sysCmd OR formSysCmd OR command_injection)